CIDR vs. Subnet Mask: What's the Difference?

CIDR notation and subnet masks are two different ways of writing down the exact same piece of information: how many bits of an IP address are reserved for the network, and how many are left for hosts. They're not competing standards - they're just different formats, and most networking tools accept both interchangeably.

Two formats, one meaning

A subnet mask is written as four decimal numbers separated by dots, matching the structure of an IP address itself - for example, 255.255.255.0. CIDR notation instead writes a single number after a slash, representing how many leading bits of that mask are set to 1 - for example, /24.

Both describe the same underlying binary pattern:

255.255.255.0  =  11111111.11111111.11111111.00000000  =  /24

Full conversion table

How to convert by hand

To go from a CIDR prefix to a subnet mask: write out that many 1 bits, pad the rest of the 32 bits with 0, then convert each 8-bit group back to decimal. For /20: twenty 1s followed by twelve 0s gives 11111111.11111111.11110000.00000000, which is 255.255.240.0.

To go the other direction, from a subnet mask to CIDR: convert each octet to binary and count the total number of 1 bits. 255.255.240.0 has 8 + 8 + 4 + 0 = 20 bits set, so it's a /20.

Where each format is used

• Cloud platforms (AWS, Azure, GCP): CIDR notation is standard when defining VPCs, subnets, and security group rules.
• Linux networking (ip addr, ip route): CIDR notation is the default.
• Windows network settings and some legacy router UIs: often expect a dotted-decimal subnet mask field.
• Cisco IOS ACLs and OSPF: use wildcard masks, the inverse of a subnet mask, rather than either of the above.

Common mistakes

• Mixing up a subnet mask with a wildcard mask - they look similar but are bitwise opposites, and using the wrong one in an ACL silently inverts your intended rule.
• Assuming a shorter subnet mask number (like /8) means a smaller network - a /8 is far larger than a /24.
• Manually converting uncommon prefixes (like /21 or /27) and making a binary arithmetic error - worth double-checking with a calculator, especially before applying a firewall rule.

Summary

CIDR notation and subnet masks are the same information in different clothes. CIDR (/24) is more compact and dominant in modern tooling; dotted-decimal (255.255.255.0) is still common in legacy interfaces. Knowing how to convert between them - or letting a calculator do it - means you're never blocked by which format a particular tool expects.